Dave (DAVE) Risk Factors

We are subject to a variety of laws, rules, directives, and regulations, as well as contractual obligations, relating to the processing of personal information, including personally identifiable information. The regulatory framework for privacy and data protection worldwide is rapidly evolving and, as a result, implementation standards and enforcement practices are likely to continue to evolve for the foreseeable future. Legislators and regulators are increasingly adopting or revising privacy and data protection laws, rules, directives, and regulations that could have a significant impact on our current and planned privacy and data protection-related practices, our processing of consumer or employee information, and our current or planned business activities. Compliance with current or future privacy and data protection laws (including those regarding security breach notification) affecting consumer and/or employee data to which we are subject could result in higher compliance and technology costs and could restrict our ability to provide certain products and services (such as products or services that involve us sharing information with third parties or storing sensitive information), which could materially and adversely affect our profitability and could reduce income from certain business initiatives. Our failure, or the failure of any third party with whom we work, to comply with privacy and data protection laws could result in potentially significant regulatory investigations and government actions, litigation, fines, or sanctions, consumer, funding source, or bank partner actions, and damage to our reputation and brand, all of which could have a material adverse effect on our business. Complying with privacy and data protection laws and regulations may cause us to incur substantial operational costs or require us to change our business practices. We may not be successful in our efforts to achieve compliance either due to internal or external factors, such as resource allocation limitations or a lack of vendor cooperation. We have in the past, and may in the future, receive complaints or notifications from third parties alleging that we have violated applicable privacy and data protection laws and regulations. Non-compliance could result in proceedings against us by governmental entities, consumers, or others. In addition to government regulation, privacy advocates and industry groups may propose new and different self-regulatory standards that may apply to us. Because the interpretation and application of privacy and data protection laws, regulations, rules, and other standards are still uncertain, it is possible that these laws, rules, regulations, and other actual or alleged legal obligations, such as contractual or self-regulatory obligations, may be interpreted and applied in a manner that is inconsistent with our existing data management practices or the functionality of our platform. If so, in addition to the possibility of fines, lawsuits and other claims, we could be required to fundamentally change our business activities and practices or which could have an adverse effect on our business. Any failure or perceived failure by us to comply with laws, regulations, policies, legal, or contractual obligations, industry standards, or regulatory guidance relating to privacy or data security, may result in governmental investigations and enforcement actions, litigation, fines and penalties, or adverse publicity, and could cause our Members and partners to lose trust in us, which could have an adverse effect on our reputation and business. We expect that there will continue to be new proposed laws, regulations, and industry standards relating to privacy, data protection, marketing, consumer communications, and information security, and we cannot determine the impact such future laws, regulations, and standards may have on our business. Future laws, regulations, standards, and other obligations or any changed interpretation of existing laws or regulations could impair our ability to develop and market new functionality and maintain and grow our Member base and increase revenue. Future restrictions on the collection, use, sharing, or disclosure of data, or additional requirements for express or implied consent of our Members, partners, or end users for the use and disclosure of such information could require us to incur additional costs or modify our platform, possibly in a material manner, and could limit our ability to develop new functionality. We rely on obtaining our Member's banking data, with their consent, through a third party, in order to provide ExtraCash, deposit and budgeting products. If such data becomes more difficult or expensive to obtain due to changing laws and regulations, our operating results may be impacted. For example, in October 2023, the CFPB proposed a rule intended to accelerate a shift towards open banking by establishing a comprehensive regulatory framework providing consumers and their authorized third parties with rights to receive access to consumers' personal financial data held by a financial institution. These rules also propose limitations on authorized third parties' (such as Dave's) collection, use and retention of such data. If we are not able to comply with these laws or regulations, or if we become liable under these laws or regulations, we could be directly harmed, and we may be forced to implement new measures to reduce our exposure to this liability. This may require us to expend substantial resources or to discontinue certain products, which would negatively affect our business, financial condition, and operating results. In addition, the increased attention focused upon liability issues as a result of lawsuits and legislative proposals could harm our reputation or otherwise adversely affect the growth of our business. Furthermore, any costs incurred as a result of this potential liability could harm our operating results.

Our success is dependent, in part, upon protecting our proprietary technology and rights. We rely on a combination of copyrights, trademarks, trade secret laws, and contractual provisions to establish and protect our proprietary rights. However, the steps we take to protect our intellectual property may be inadequate. Any of our trademarks or other intellectual property rights may be challenged or circumvented by others or invalidated through administrative process or litigation. Furthermore, legal standards relating to the validity, enforceability, and scope of protection of intellectual property rights are uncertain. Despite our precautions, it may be possible for unauthorized third parties to copy our products and use information that we regard as proprietary to create products and services that compete with ours. No assurance can be given that the contractual agreements we enter into to establish and protect our proprietary rights will be effective in controlling access to and distribution of our products and proprietary information. Further, these agreements do not prevent our competitors or partners from independently developing technologies that are substantially equivalent or superior to our platform.

In the normal course of business, we collect, process, use and retain sensitive and confidential information regarding our Members and prospective Members, including data provided by and related to Members and their transactions, as well as other data of the counterparties to their payments. We also have arrangements in place with certain third-party service providers that require us to share consumer information for servicing purposes. Information security risks in the financial services industry continue to increase generally, in part because of new technologies, the use of the Internet and telecommunications technologies (including mobile devices) to conduct financial and other business transactions and the increased sophistication and activities of organized criminals, perpetrators of fraud, hackers, terrorists and other malicious third parties. In addition to cyberattacks and other security breaches involving the theft of sensitive and confidential information, hackers, terrorists, sophisticated nation-state and nation-state supported actors and other malicious third parties recently have engaged in attacks that are designed to disrupt key business services, such as consumer-facing applications and websites. These cybersecurity challenges, including threats to our own IT infrastructure or those of third-party providers, may take a variety of forms ranging from stolen bank accounts, business email compromise, user fraud, account takeover, check fraud or cybersecurity attacks, such as ransomware, unauthorized encryption, denial-of-service attacks, social engineering, unauthorized access, spam or other attacks, to "mega breaches" targeted against cloud-based services and other hosted software, which could be initiated by individual or groups of hackers or sophisticated cyber criminals. A cybersecurity incident or breach could result in disclosure of confidential information and intellectual property, or cause service interruptions and compromised data. We may be unable to anticipate or prevent techniques used in the future to obtain unauthorized access or to sabotage systems because they change frequently and often are not detected until after an incident has occurred. Our information technology and infrastructure, as well as those of our third-party service providers, have experienced breaches and may be subject or vulnerable in the future to breaches or attacks. For example, a third-party breach resulted in improper disclosure of certain of our Members' information, and any future improper disclosure of our own confidential business information or the information of our Members could materially and adversely affect our business. A core aspect of our business is the reliability and security of our platform. Any perceived or actual breach of security, regardless of how it occurs or the extent of the breach, could have a significant impact on our reputation as a trusted brand, cause us to lose existing partners or Members, prevent us from obtaining new partners and Members, require us to expend significant funds to remedy problems caused by breaches and implement measures to prevent further breaches, and expose us to legal risk and potential liability including from governmental or regulatory investigations, class action litigation and other lawsuits. If sensitive information is lost or improperly disclosed through a data breach or otherwise or threatened to be disclosed, we could experience a loss of confidence by our partners and Members in the security of our systems, products and services and prevent us from obtaining new partners and Members, and we could incur significant costs to remedy problems caused by breaches and implement measures to prevent further breaches, and expose us to legal risk and potential liability and penalties, including from governmental or regulatory investigations, class action litigation and other lawsuits, all of which could adversely affect our reputation and our operating results. Any actual or perceived security breach at a company providing services to us or our Members could have similar effects. Most jurisdictions have enacted laws requiring companies to notify individuals, regulatory authorities and others of security breaches involving certain types of data. In addition, our agreements with certain partners and service providers may require us to notify them in the event of a security breach. Such mandatory disclosures are costly, could lead to negative publicity, may cause our Members to lose confidence in the effectiveness of our security measures and require us to expend significant capital and other resources to respond to and/or alleviate problems caused by the actual or perceived security breach. A security breach of any of our vendors that processes personally identifiable information of our Members may pose similar risks. In May 2020, an unauthorized third party attempted to gain access to Dave Member accounts and was able to access Member profiles and Members' partial or incomplete bank account information. We did not uncover any evidence that the attacker was able to take any actions with respect to the data, other than gaining read access to it, nor do we believe any unauthorized transactions were made or advances requested on our platform. We provided notice to relevant parties as required under applicable law and agreements and took steps to set up alerts to detect abnormal request volumes and introduced rate limiting at the IP address level. In addition, in June 2020, we were notified of an unauthorized third party breach of our Dave database. The third party was able to access to Dave's system by breaching the system of one of Dave's third party service providers. The attacker was able to download a large data set, including encrypted social security numbers for some Members; however, there was no evidence that unauthorized transactions were made or advances requested on our platform, nor do we believe that the third party gained access to decryption keys or was otherwise able to decrypt encrypted information. The May 2020 and June 2020 incidents are collectively referred to herein as the "2020 Incidents." We took remedial measures, including the engagement of an outside security consultant to monitor for ongoing dark web activity and to conduct a security audit and incident investigation, and notified relevant parties as required under applicable law and agreements. As a result of the 2020 Incidents, we are in the process of settling a purported class action in California for approximately $3.1 million and we settled individual claims outside of California for approximately $4.4 million. See Item 1. Legal Proceedings. In addition, in 2024, one of our third-party service providers experienced a data breach that resulted in improper disclosure of certain of our Members' information. As we have increased our Member base and our brand has become more widely known and recognized, third parties may continue to seek to compromise our security controls or gain unauthorized access to our sensitive corporate information or our Members' data. If our banking partner or other strategic partners were to conclude that our systems and security policies and procedures are insufficiently rigorous, they could terminate their relationships with us, and our financial results and business could be adversely affected. Under our terms of service and our contracts with strategic partners, if there is a breach of non-public personal information of our Members that we store, we could be liable to the partner for their losses and related expenses. Additionally, as computer malware, viruses, and computer hacking, fraudulent use attempts, and phishing attacks have become more prevalent, we, and third parties upon which we rely, face increased risk in maintaining the performance, reliability, security, and availability of our solutions and related services and technical infrastructure to the satisfaction of our Members. Any computer malware, viruses, computer hacking, fraudulent use attempts, phishing attacks, or other data security breaches related to our network infrastructure or information technology systems or to computer hardware we lease from third parties, could, among other things, harm our reputation and our ability to retain existing Members and attract new Members. Our insurance may be insufficient or may not cover all liabilities incurred by cybersecurity incidents. We also cannot be certain that our insurance coverage will be adequate for data handling or data security liabilities actually incurred, that insurance will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material adverse effect on our business, including our financial condition, operating results, and reputation.

The industries in which we compete are highly competitive and subject to rapid and significant changes. We compete against companies and financial institutions across the retail banking, financial services, consumer technology and financial technology services industries, as well as other nonbank lenders serving credit-challenged consumers, including online marketplace lenders, check cashers, point-of-sale lenders and payday lenders. We may compete with others in the market who may in the future provide offerings similar to ours, particularly companies who may provide money management, lending and other services though a platform similar to our platform. These and other competitors in the banking and financial technology industries are introducing innovative products and services that may compete with ours. We expect that this competition will continue as banking and financial technology industries continue to evolve, particularly if non-traditional non-recourse advance providers and other parties gain greater market share in these industries. If we are unable to differentiate our products and platform from and successfully compete with those of our competitors, our business, results of operations and financial condition will be materially and adversely affected. Many existing and potential competitors are entities substantially larger in size and more established, including with greater resources, highly diversified revenues and significantly more brand awareness than ours. As such, many of our competitors can leverage their size, robust networks, financial wherewithal, brand awareness, pricing power and technological assets to compete with us. To the extent new entrants gain market share, the purchase and use of our products and services would decline. If price competition materially intensifies, we may have to decrease the prices of our products and services, which would likely adversely affect the results of operations. Our long-term success depends on our ability to compete effectively against existing and potential competitors that seek to provide banking and financial technology products and services. If we fail to compete effectively against these competitors, our revenues, results of operations, prospects for future growth and overall business will be materially and adversely affected.

Negative publicity about us or our industry, even if inaccurate, could adversely affect our reputation and the confidence in, and use of our platform, potentially harming our reputation and causing disruptions to our platform. Such negative publicity could involve: the transparency, fairness, Member experience, quality, and reliability of our platform or consumer fintech platforms in general, the effectiveness of our risk models, our ability to effectively manage and resolve complaints, our privacy and security practices, litigation, regulatory activity, misconduct by our employees, funding sources, bank partners and structure of our bank partner products, service providers, or others in our industry, the experience of consumers with our platform or services. Any such reputational harm could further affect the behavior of consumers, including their willingness to obtain advances, deposit accounts, and other products and services facilitated through our platform. As a result, our business, results of operations, financial condition, and future prospects would be materially and adversely affected.

Our success and future growth depend upon the continued services of our management team and other key employees who are critical to our overall management, as well as the continued development of our products, strategic partnerships, our culture and our strategic direction. We currently do not have "key person" insurance on any of our employees. The loss of one or more of our senior management team members or other key employees could disrupt or harm our business, and we may not be able to find adequate replacements. We cannot provide assurance that we will be able to retain the services of any members of our senior management or other key employees or that we would be able to timely replace members of our senior management or other key employees should any of them depart.

Our business involves processing of large numbers of transactions and management of the data necessary to do so. Our success depends upon the efficient and error-free handling of the money that is collected, remitted or deposited in connection with the provision of our products and services. We rely on the ability of our vendors and third-parties to process and facilitate these transactions, including ACH processing (as we are not a bank), and debit card payment processing, in an efficient, uninterrupted and error-free manner. We also rely on third-party service providers to perform various functions relating to our business, including software development, marketing, operational functions, fraud detection, cloud infrastructure services, information technology, data analysis, and, because we are not a bank and cannot belong or directly access the ACH payment network, ACH processing, and debit card payment processing. While we oversee these service providers to ensure they provide services in accordance with our agreements and regulatory requirements, we do not have control over the operations of any of the third-party service providers that we utilize. In the event that a third-party service provider fails to perform such functions for any reason, including negligence, willful misconduct or fraud, fire, natural disaster, power loss, telecommunication failures, software and hardware defects, terrorist attacks and similar events, our ability to process payments and perform other operational functions for which we currently rely on such third-party service providers will suffer and our business, cash flows and future prospects may be negatively impacted. We use both internally developed and third-party systems, including cloud computing and storage systems, for our services and certain aspects of transaction processing. Any damage to, or failure of, third party computer network systems or data centers generally, or those of our vendors (including as a result of disruptions at our third-party data center hosting facilities and cloud providers), or an improper action by our employees, agents or third-party vendors, could result in interruptions in our services, causing Members and other partners to become dissatisfied with our products and services or subject us to potential financial losses. Sustained or repeated system failures could reduce the attractiveness of our products and services, and result in Member attrition, thereby reducing operating revenue and harming our results of operations. Further, negative publicity arising from these types of disruptions could be damaging to our reputation and may adversely impact use of our products and services, including our platform, and adversely affect our ability to attract new Members and business partners.

We generate revenue by charging Members a fixed monthly rate for membership to our platform as well as additional fees related to optional expedited delivery of advances. Members who obtain an ExtraCash advance through our platform also have the option to tip us. We also generate revenue from our Dave banking product through interchange and out-of-network ATM fees, as well as from our job portal service through referral fees from partner companies. As the market for our platform matures, as new or existing competitors introduce new products or services that compete with ours or if general inflationary pressures continue, we may experience pricing pressure and be unable to retain current Members and attract new Members at prices that are consistent with our pricing model and operating budget. Our pricing strategy for new products and services may prove to be unappealing to our Members, and our competitors could choose to bundle certain products and services to be competitive with ours. If this were to occur, it is possible that we would have to change our pricing strategies or reduce our prices, which could harm our revenue, gross profits, and operating results.

Natural disasters, pandemics, other catastrophic events or man-made disasters may cause damage or disruption to our operations, international commerce and the global economy, and thus could harm our business. We have a large employee presence in Los Angeles, California, and our data centers are located in the Midwest. The west coast of the United States contains active earthquake zones and the greater Los Angeles area has experienced major fire danger in the past five years and may experience major fires in the future. In the event of a major earthquake, hurricane or catastrophic event such as fire, power loss, telecommunications failure, political instability, civil unrest, war, or terrorist attack, we may be unable to continue our operations and may experience system interruptions, reputational harm, delays in our application development, lengthy interruptions in the availability of our products and services, breaches of data security, and loss of critical data, all of which could harm our business, operating results, and financial condition. In addition, the insurance we maintain may not cover or may be insufficient to cover our losses resulting from disasters, or other business interruptions, and any incidents may result in loss of, or increased costs of, such insurance.